Terraform vs Ansible
Infrastructure provisioning versus configuration management, two pillars of Infrastructure as Code.
Terraform is a declarative infrastructure provisioning tool that creates and manages cloud resources through state files, while Ansible is a procedural/declarative configuration management and automation tool that configures servers and deploys applications over SSH. Terraform excels at creating infrastructure (servers, networks, databases), and Ansible excels at configuring what runs on that infrastructure. Most DevOps teams use both together.
Terraform
Terraform, created by HashiCorp, is an open-source Infrastructure as Code (IaC) tool that lets you define cloud infrastructure in declarative configuration files using HCL (HashiCorp Configuration Language). You describe the desired end state of your infrastructure, and Terraform figures out how to achieve it: creating, modifying, or destroying resources as needed. Terraform maintains a state file that tracks what it has created, enabling it to calculate precise diffs between current and desired state. It supports every major cloud provider (AWS, Azure, GCP) and hundreds of other services through providers. Terraform plans show you exactly what will change before you apply, reducing the risk of unintended modifications. Modules enable reusable infrastructure components. The tool is cloud-agnostic, letting you manage multi-cloud environments with a single workflow.
Ansible
Ansible, maintained by Red Hat, is an open-source automation tool for configuration management, application deployment, and task automation. Ansible uses YAML-based playbooks to define tasks that are executed sequentially on target machines over SSH (no agent installation required). This agentless architecture makes Ansible simple to adopt: install it on one control node and start managing servers immediately. Ansible modules cover everything from package installation and file management to cloud resource provisioning and container orchestration. Its inventory system groups servers by role or environment, and variables enable flexible, reusable configurations. Ansible Galaxy provides a community hub for sharing roles and collections. While Ansible can provision infrastructure, its strength lies in configuring servers, deploying applications, and orchestrating multi-step workflows across groups of machines.
Key Differences
- **Primary purpose**: Terraform provisions infrastructure (VMs, networks, databases, load balancers). Ansible configures and manages what runs on infrastructure (packages, services, files, deployments). - **Approach**: Terraform is purely declarative (you define the end state). Ansible playbooks are procedural (tasks run in order), though many modules are idempotent. - **State management**: Terraform maintains a state file tracking all managed resources. Ansible is stateless, determining current state by inspecting targets at runtime. - **Agent model**: Terraform communicates with cloud APIs directly. Ansible connects to servers over SSH with no agent required. - **Change planning**: Terraform provides a plan/preview of changes before applying. Ansible has a check mode (dry run) but it is less precise for complex playbooks. - **Idempotency**: Terraform is inherently idempotent through state comparison. Ansible's idempotency depends on using the right modules correctly.
When to Use Each
**Use Terraform** for provisioning cloud infrastructure: creating VPCs, EC2 instances, RDS databases, S3 buckets, Kubernetes clusters, DNS records, and any cloud resource. It is the standard for defining and versioning infrastructure. **Use Ansible** for server configuration (installing packages, managing services, deploying application code), orchestrating multi-step deployment processes, and ad-hoc automation tasks across server fleets. **Use both together**: Terraform creates the infrastructure, and Ansible configures it. This is the most common pattern in mature DevOps teams.
Analogy
**Terraform** is like an architect who designs and builds the structure of a building: the foundation, walls, plumbing, and electrical systems. They create the infrastructure from blueprints. **Ansible** is like an interior decorator and facilities manager: once the building exists, they furnish the rooms, set up equipment, maintain the systems, and make sure everything inside is running properly.